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A  communication  protocol  is  introduced  that  allows  the  receiver  of  a  message  to  place  an  a  poste¬ 
riori  bound  on  the  amount  of  information  that  an  eavesdropper  could  have  obtained  during  trans¬ 
mission  of  that  message.  This  quantum  cryptographic  protocol  is  distinct  from  quantum  key  distri¬ 
bution.  The  quantum  states  and  measurements  required  by  this  protocol  are  simple  enough  that  it 
can  be  implemented  using  existing  technology. 


A  major  concern  when  transmitting  a  secret  message 
over  a  public  communication  channel  is  that  an  eaves¬ 
dropper  might  intercept  the  message  and  learn  its  mean¬ 
ing.  This  is  combatted  by  encrypting  the  message  so  that 
an  eavesdropper  cannot  decipher  the  meaning  of  the  in¬ 
tercepted  message.  [1,  2]  In  its  most  secure  form,  this  re¬ 
lies  upon  the  communicating  parties  sharing  a  single-use 
private  key  which  is  as  long  as  the  message.  [1]  Recently, 
great  strides  have  been  made  at  generating  and  distribut¬ 
ing  private  keys  using  quantum  mechanical  systems  sent 
through  insecure  channels.  [3]  Such  quantum  key  genera¬ 
tion  (QKD)  protocols  have  the  distinct  feature  that  an 
eavesdropper  leaves  evidence  of  her  activity.  However, 
due  to  their  design,  these  QKD  protocols  do  not  convey 
messages. 

In  this  Letter  we  introduce  a  quantum  seal  protocol, 
which  is  a  method  for  two  parties  to  communicate  a  mes¬ 
sage,  not  simply  to  generate  a  random  key.  [4,  5]  Its  utility 
comes  from  the  fact  that  it  allows  the  receiver  to  place 
an  a  posteriori  bound  on  the  amount  of  information  an 
eavesdropper  could  have  obtained  over  the  course  of  the 
transmission.  Each  time  a  message  is  sent,  there  is  a 
straightforward  way  in  which  an  eavesdropper  can  at¬ 
tempt  to  intercept  the  message.  Yet  if  this  occurs,  the 
receiver  will  be  given  an  unambiguous  indication  that 
there  was  a  disturbance  in  the  system  and  an  eavesdrop¬ 
per  may  have  been  tapping  into  the  communication  chan¬ 
nel.  If  there  is  no  eavesdropper  and  the  quantum  channel 
is  relatively  noise-free,  then  the  receiver  will  have  confi¬ 
dence  that  no  other  parties  have  read  the  message. 

This  protocol  can  be  used  to  seal  up  and  communicate 
an  encrypted  message,  thereby  providing  an  extra  layer  of 
assurance  while  sending  sensitive  material,  on  top  of  any 
sophisticated  encryption  technique  that  may  currently  be 
used. 

The  protocol  involves  a  message  sender,  named  Alice, 
trying  to  get  a  message  bit  b  (whose  values  can  be  zero 
or  one)  to  a  receiver,  called  Bob.  The  entire  process 
is  initiated  by  Alice  announcing  that  she  has  a  message 
she  wants  to  communicate  to  Bob.  Then  a  routine  is 
repeated  many  times.  Each  repetition  is  referred  to  as  a 
single  “shot”,  and  proceeds  as  follows. 

Bob  starts  the  routine  by  preparing  some  physical  sys- 


TABLE  I:  Each  shot,  Alice  makes  one  of  the  following  eight 
announcement  s. 


Bit- Announcements 

Result- Announcements 

CTl 

c  =  0 

CTl 

m  =  -1-1 

cJ-i 

c  =  1 

CTl 

m  =  —1 

cs 

c  =  0 

0-3 

m  =  -1-1 

0-3 

C  =  1 

0-3 

m  =  —1 

tern  (which  we  refer  to  as  a  particle)  in  one  of  four  quan¬ 
tum  states,  represented  by  density  matrices  =  |0)(0|, 
=  |-b)(-b|,  or  p(-)  =  |-)(-|.  (Here 
we  have  used  the  standard  notation  for  a  qubit  Hilbert 
space  that  is  spanned  by  basis  vectors  |0)  and  |1)  and 
|±)  =  2“2  [|0)±|1)].)  Bob  employs  a  randomized  method 
of  preparation  so  that  he  is  equally  likely  to  prepare  the 
particle  in  any  of  these  four  states.  Bob  records  which 
state  he  has  prepared  and  sends  the  particle  to  Alice. 

Upon  receipt  of  the  particle,  Alice  makes  one  of  two 
measurements:  with  probability  one-half  she  makes  a 
measurement  corresponding  to  cti  =  |+)(+|  —  |— )(— |, 
and  with  probability  one-half  she  makes  a  measurement 
corresponding  to  0-3  =  |0)(0|  —  |I)(I|.  Alice  records  her 
measurement  result  as  m  (which  will  be  -1-1  or  —1)  and 
announces  whether  her  measurement  corresponded  to  (Ti 
or  0-3. 

Then  Alice  makes  a  second  announcement.  With  prob¬ 
ability  Pa  she  announces  the  classical  bit  c  which  is  de¬ 
termined  from  the  message  bit  b  and  the  measurement 
result  m  using 

c=^5-|-^  2”^}  mod  2  ,  (1) 

which  we  refer  to  as  a  bit- announcement.  Or  else,  (with 
probability  [1  —  Pa])  she  announces  the  value  of  m,  which 
we  refer  to  as  a  result- announcement.  This  completes  the 
routine  for  a  single  shot. 

Each  time  that  Alice  makes  a  bit-announcement  Bob 
has  a  chance  to  determine  the  value  of  6,  provided  that  he 
has  prepared  the  particle  in  an  eigenstate  of  the  measure¬ 
ment  operator  corresponding  to  the  measurement  that 
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Alice  performs.  In  such  a  case,  Bob  uses  his  conjectured 
value  of  m  (based  on  his  knowledge  of  the  state  he  pre¬ 
pared  and  his  knowledge  of  the  measurement  made  by 
Alice)  along  with  the  equation 

6=^c-|-^  2^}  mod  2  (2) 

to  determine  the  value  of  b.  Bob  can  only  do  this 
when  the  state  in  which  he  prepares  the  particle  and 
the  measurement  that  Alice  performs  have  a  “matching 
basis,”  which  occurs  with  probability  Pa/2.  If  a  bit- 
announcement  is  made  on  a  shot  when  Alice  and  Bob 
do  not  have  a  matching  basis  then  Bob  will  not  know 
which  value  of  m  to  use  in  order  to  calculate  the  value 
of  b.  Similarly,  since  every  outside  observer  lacks  Bob’s 
knowledge  of  the  state  in  which  he  prepared  the  particle, 
both  values  of  m  are  equally  likely  (for  either  measure¬ 
ment).  An  eavesdropper  who  is  simply  listening  to  the 
announcements  made  by  Alice  will  not  be  able  to  deter¬ 
mine  the  value  of  the  message  bit  b.  (The  analysis  below 
provides  a  rigorous  method  to  support  this  last  heuristic 
statement.) 

In  order  to  have  a  good  chance  that  their  bases  will  be 
matched  up  at  least  once  on  a  bit-announcement.  Bob 
and  Alice  will  repeat  this  routine  N  times,  where  the 
value  of  N  can  be  chosen  in  the  following  way.  They  set 
some  target  confidence  level  Cm,  where  0  <  Cm  <  1, 
and  choose  N  so  that  the  probability  of  matching  bases 
during  a  bit-announcement  will  be  at  least  Cm-  This 
leads  to  the  value  of  N  which  is  the  next  integer  greater 
than  log(l  —  Cm)/  log(l  —pal2).  (This  ignores  the  likeli¬ 
hood  that  some  of  the  particles  will  not  reach  Alice  due 
to  imperfections  in  the  quantum  channel.  This  can  be 
thought  of  as  a  “null”  announcement  by  Alice  and  simply 
increases  the  number  of  shots  that  Bob  needs  to  initiate 
in  order  to  reach  the  target  confidence  level.) 

Each  time  that  Alice  makes  a  result-announcement  it 
gives  Bob  an  opportunity  to  test  the  quantum  channel  for 
noise  (which  may  be  due  to  imperfections  in  the  system  or 
an  eavesdropper) .  Since  Bob  knows  the  state  in  which  he 
prepared  the  particle  (for  each  shot),  a  statistical  analysis 
of  the  measurement  results  allows  him  to  determine  if  the 
state  of  the  particle  is  being  changed  after  it  leaves  him 
but  before  it  is  measured  by  Alice. 

Bob  expects  to  have  (1  —pa)N,  opportunities  to  check 
the  measurement  results;  as  Pa  becomes  very  small,  this 
grows  as  -  log(l  -  C'm)[2/pa  -  5/2  -k  llpa/24  -f  0(pa)^]- 
(Using  the  value  of  N  determined  earlier.)  On  the  other 
hand,  the  number  of  bit-announcements  (each  of  which 
provides  an  opportunity  for  an  eavesdropper,  called  Eve, 
to  gain  knowledge  of  b)  is  expected  to  be  PaN;  as  Pa 
becomes  very  small,  this  only  goes  like  —  log(l  —  Cm) [2  — 
Pa/2  —  0{pa)‘^]-  Of  course,  Alice  and  Bob  are  free  to  set 
Pa  as  close  to  zero  as  they  wish.  As  they  decrease  Pa,  N 
will  increase,  and  the  number  of  opportunities  they  get 
to  characterize  the  channel  will  increase,  but  the  number 


of  opportunities  that  Eve  expects  to  get  to  obtain  the 
message  will  not  increase  beyond  — 21og(l  —  Cm)- 

Now  that  we  have  given  a  description  of  this  protocol, 
two  parts  remain  to  the  analysis:  Eirst,  to  describe  pos¬ 
sible  eavesdropping  strategies  and  quantify  the  amount 
of  information  Eve  expects  to  gain  from  her  actions.  Sec¬ 
ond,  to  show  how  Bob  can  place  a  bound  on  the  Eve’s 
expected  information  from  his  statistical  error  analysis. 

Due  to  the  fact  that  Bob  has  a  1/4  chance  to  produce 
any  of  the  four  possible  initial  states  p^^'> ,  ,  p^~^\  and 

p^~\  Eve’s  best  description  of  the  initial  state  of  the  par¬ 
ticle  —  on  every  shot  —  is  p  =  4/,  where  /  is  the  identity 
operator.  An  eavesdropper’s  goal  is  to  choose  her  actions 
so  that  her  description  of  the  state  of  the  particle  is  im¬ 
proved.  This  will  lead  to  a  better  prediction  of  Alice’s 
measurement  results  which  will  in  turn  allow  her  to  de¬ 
duce  the  message  from  Alice’s  announcements. 

On  each  shot,  an  eavesdropper  has  only  two  options: 
either  apply  a  quantum  operation  £  to  the  particle  or 
perform  a  measurement  (POVM)  Ai  on  the  particle.  Ei¬ 
ther  option  will  generally  change  the  state  of  the  particle 
(according  to  Eve’s  description).  A  quantum  operation 
is  described  by  a  set  of  operators  {Ei,E2,  -  -  -  ,Er}  with 
the  constraint  cjEi  =  I.  When  applying  a  quantum 
operation  to  a  particle  described  by  the  state  p,  the  fi¬ 
nal  state  is  described  by  p'  =  '^iEipEj.  Similarly,  a 
measurement  with  d  possible  outcomes  is  described  by  a 
set  of  operators  {Fi,  F2, . . . ,  Ed}  subject  to  the  constraint 
’^^F^Ei  =  I.  When  the  measurement  is  performed  on 
the  particle  described  by  state  p  and  the  outcome  i  is 
found,  the  state  after  the  measurement  is  then  described 
by  p'  =  FipF} /Ti{FipFl).  Generally,  we  describe  the 
mapping  11  from  the  initial  state  of  the  particle  p  to  its 
final  state  11  (p)  =  p'  as  the  effective- evolution  of  the  state 
of  the  particle  on  that  shot. 

Over  the  course  of  the  N  shots,  we  describe 
the  effective-evolution  string  of  length  N  as  S  = 
(Hi,  112, . . . ,  Bat)  where  11^  is  the  effective-evolution 
which  occurred  on  the  z**'  shot.  It  can  be  shown  that  for 
the  qubit  case  at  hand,  the  set  of  all  possible  effective- 
evolution  strings  of  length  N  is  a  compact  set. 

Generally,  the  particular  effective-evolution  that  oc¬ 
curs  on  a  given  shot  is  decided  randomly.  (Especially  in 
the  case  when  an  effective-evolution  occurs  as  a  result 
of  measurement.)  Therefore,  the  a  priori  description  of 
an  eavesdropper’s  effect  on  the  state  of  the  particle  will 
be  through  a  set  of  possible  effective-evolution  strings 
of  length  N,  along  with  the  probability  Pr(iSi)  that  the 
string  Si  will  be  the  one  that  occurs. 

To  describe  how  much  of  the  message  an  eavesdrop¬ 
per  expects  to  obtain  by  imposing  a  particular  effective- 
evolution  string  on  the  particle,  we  use  the  mutual  infor¬ 
mation  between  the  random  variable  B  describing  all  the 
possible  messages  and  the  random  variable  A  describing 
all  the  possible  announcement  strings. 
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TABLE  II:  The  probability  for  the  eight  possible  announce¬ 
ments  given  a  particular  value  for  b  and  given  that  an  eaves¬ 
dropper  causes  the  state  to  change  from  p  to  p'  =  11  (p).  For 
Eve,  the  initial  state  is  always  described  by  p  =  ij  whereas 
Bob’s  description  of  the  initial  state  is  based  upon  his  knowl¬ 
edge  of  the  particular  pure  state  he  prepared  on  that  shot. 


Pr(cri,c  =  0|n,p,  fe) 
Pr(cri,c=l|n,p,  fe) 
Pr(cr3,c  =  0|n,p,6) 
Pr(cr3,c=l|n,p,fe) 
Pr((Ti,m  =  -|-l|n,p,  b) 
Pr(cri,m  =  -l|n,p,  b) 
Pr(cr3,m  =  -|-l|n,p,  b) 
Pr((T3,m  =  -l|n,p,  b) 


i^[l  +  (l_2&)Tr(<7ip')] 
^[l-(l-2&)Tr(aip')] 
If[l  +  {l-2b)Triasp')] 
^[l-(l-2&)Tr(a3p')] 
i^[l  +  Tr(aip')l 
i^[l-Tr(aip')l 
i^[l  +  Tr(a3p')l 
i^[l-Tr(a3p')l 


The  possible  messages  are  5  =  0  and  5  =  1,  both  with 
a  priori  probability  one-half. 

There  are  8^  possible  announcement  strings,  which 
comes  from  the  eight  possible  announcements  (shown 
in  Table  I)  for  each  of  the  N  shots.  The  probabil¬ 
ity  Pr(a|5,  iS)  that  Alice  makes  the  announcement-string 
a  =  (oi, . . . ,  Oat)  given  a  particular  value  of  5  and  given 
that  Eve’s  actions  result  in  the  effective-evolution  string 
5  =  (Hi, . . .  ,nAr)  is 


N 

Pr(a|5,5)  =  Pr(ai|5, 11*)  .  (3) 

i=l 

The  probabilities  for  the  eight  different  announcements 
on  each  shot  are  shown  in  Table  II. 

The  mutual  information  Is{^  '■  B)  between  ran¬ 
dom  variables  A  and  B  describes  the  amount  of  knowl¬ 
edge  (on  average)  Eve  expects  to  gain  about  the  mes¬ 
sage  from  Alice’s  announcements  when  she  imposes 
the  effective-evolution  string  S.  It  is  calculated  by 

_ I 


Is{A  :  B)  =  ^Pr(5)  ^  Pr(a|5, 5)  logPr(a|5, 5) 

b=0  a(") 

-  ^  Pr(a|5)  log  Pr(a|5)  (4) 

a('V) 

where  the  sum  over  indicates  that  the  sum  is  taken 
over  possible  announcement  strings  of  length  N,  and 
where  Pr(a|5)  =  5[Pr(a|5  =  0,iS)  +  Pr(a|5=  1, 5)]. 

Each  possible  announcement  string  a  can  be  “split- 
up”  into  X,  the  string  of  the  bit-announcements  in  a, 
and  y,  the  string  of  the  result-announcements  in  a.  The 
probability  Pr(a|5, 5)  can  be  written  as 

Pr(a|5,5)  =  Pr(x|5,r)Pr(y|5,5f)  ,  (5) 

where  T  is  the  effective-evolution  string  for  the  shots 
when  bit-announcements  are  made  and  where  U  is 
the  effective-evolution  string  for  the  shots  when  result- 
announcements  are  made. 

Because  of  the  probabilistic  nature  of  the  protocol,  the 
number  of  bit-announcements  is  not  fixed.  The  probabil¬ 
ity  Pr(fc)  that  Alice  makes  k  bit-announcements  can  be 
calculated  using  the  binomial  distribution: 

where  fc  =  0, 1, . . . ,  In  other  words,  this  is  the  prob¬ 
ability  that  the  string  x  will  have  length  k.  The  k  bit- 
announcements  can  be  distributed  among  the  N  shots 
in  (^)  =  different  ways.  Since  Eve  does  not 

know  before-hand  which  shots  will  correspond  to  bit- 
announcements,  when  calculating  the  mutual  informa¬ 
tion  she  must  take  into  account  that  T  can  be  chosen  in 
('^)  ways  from  the  effective-evolutions  in  S. 

Utilizing  these  results,  we  rewrite  Equation  (4)  as 


Is{A:  B) 

6=0  fc  r<'“)  ^k) 

fc  r('=)  x(*’) 


where  the  sum  over  x*^^)  (y*-'^”^^)  indicates  that  the 
sum  is  taken  over  possible  bit-announcement  (result- 
announcement)  strings  of  length  k  (respectively,  [A  —  fc]) 
and  where  the  sum  over  indicates  that  this 

sum  is  taken  over  all  possible  ways  in  which  the 
effective-evolution  string  of  length  fc  (corresponding  to 


Pr(x|5,  T)  Pr(y|5,  U)  log  [Pr(x|5,  T)  Pr(y|5,5/)] 

) 

IT)  Pr(y|W)  log  [Pr(x|r)  Pr(y|5/)]  (6) 


bit-announcements)  can  be  chosen  from  the  effective- 
evolution  string  S.  The  effective-evolution  string  U  is  the 
resulting  effective-evolution  string  of  length  A  —  fc  when 
the  string  T  is  “plucked-out”  of  the  string  S.  Because  the 
result-announcements  have  no  dependence  on  the  mes¬ 
sage,  neither  do  the  result-announcement  strings.  That 
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IS, 


Pr(y|6  =  0,ZY)  =  Pr(y|5=l,Z^)  =  Pr(y|W)  , 


for  every  U.  It  is  straightforward  to  show  that  this  results 
in  a  great  simplification  of  Equation  (6)  to 

Is{A-B)  = 
k  \k)  r(*^)  L  6=0  x(*^) 


— Pr(x|T)  logPr(x|T) 


>c(^) 


(7) 


This  leads  to  the  natural  introduction  of  +  1  new 
random  variables,  for  k  =  0, 1, . . . ,  A^,  where 
describes  the  possible  bit-announcement  strings  of  length 
k.  We  can  now  rewrite  Equation  (7)  as 

N 

=  :B)  .  (8) 

k=0  TC^) 

This  completes  the  analysis  of  the  amount  of  information 
that  an  eavesdropper  expects  to  gain  about  the  message 
when  her  eavesdropping  activity  induces  the  effective- 
evolution  string  S. 

It  is  worthwhile  mentioning  here  that  using  Eqs.  (8) 
and  (3)  we  can  now  provide  quantitative  support  for  our 
earlier  comment  about  the  ignorance  of  an  eavesdrop¬ 
per  who  is  listening  to  Alice’s  announcements  but  not 
interacting  with  the  particle  in  any  way.  In  this  case, 
the  effective-evolution  mapping  11  is  the  identity  map¬ 
ping  on  every  shot.  Therefore,  it  is  straightforward  to 
show  that  Is{A  :  B)  =  0  because  the  probabilities  for 
the  bit-announcements  (shown  in  Table  II)  do  not  de¬ 
pend  on  b. 

After  the  N  shots  are  performed,  Alice  will  have  made 
a  specific  string  of  announcements  a,  which  corresponds 
to  specific  strings  of  bit-announcements  x  (of  length  k) 
and  result-announcements  y.  Eor  each  of  the  announce¬ 
ments  Uj,  Bob  knows  the  state  pi  in  which  he  prepared  the 
particle.  As  discussed  earlier,  he  uses  this  knowledge  of 
the  initial  states,  along  with  the  k  bit-announcements  Xa 
for  Of  =  1, . . . ,  fc  to  determine  the  message.  We  will  now 
describe  how  he  uses  Alice’s  N  —  k  result-announcements 
yp  for  (3  =  1, . . . ,  {N  —  k)  along  with  his  knowledge  of  the 
corresponding  initial  states  pp  for  /?  =  I, . . . ,  (A^  —  A:)  to 
determine  the  likelihood  that  the  message  was  exposed  to 
an  eavesdropper.  We  describe  this  string  of  initial  states 
by  p  =  (pi,  P2,  •  •  • ,  which  corresponds  to  the  shots 

where  Alice  makes  result-announcements. 

Given  an  effective-evolution  string  S  that  Eve  in¬ 
duces  by  her  actions,  k  of  these  actions  will  have  oc¬ 
curred  on  shots  when  Alice  makes  a  bit-announcement 
and  N  —  k  occurred  on  shots  when  Alice  makes  a 


result-announcement.  We  can  calculate  Pr(y|5,  p)  the 
probability  (from  Bob’s  point  of  view)  of  Alice  making 
the  result-announcements  y  given  the  effective-evolution 
string  S  induced  by  Eve’s  actions.  To  do  this,  we  use  the 
string  U  =  {Hi, . . .  of  effective  evolutions  in  S 

that  occurred  during  shots  when  a  result-announcement 
was  made.  This  probability  is  determined  using 


N-k 

Pr(y|5,p)  =  Pr(ai|n,,p,)  .  (9) 

i=l 


We  now  form  a  set  of  effective-evolution  strings  E(£)  such 
that  S  is  an  element  of  E(e)  if  Pr(y|iS,  p)  >  £  for  some 
number  0  <  £  <  I.  That  is,  we  include  an  effective- 
evolution  string  in  the  set  S(£)  if  there  is  a  substantial 
probability,  based  upon  the  result-announcement  data, 
that  that  effective-evolution  string  was  induced  by  an 
eavesdropper. 

We  define  the  exposure  Ie{£)  of  the  message  to  be 


Ie{£) 


max 

(^) 


Ir{X^'^  :  B). 
r("7) 


(10) 


This  maximum  is  known  to  exist  because  E(£)  is  a  com¬ 
pact  set.  This  completes  the  analysis  describing  how  the 
receiver  sets  a  bound  on  the  amount  of  a  message  exposed 
to  any  eavesdroppers. 

While  using  this  protocol  to  transmit  messages,  if  some 
messages  have  been  transmitted  with  no  exposure  to 
eavesdroppers,  these  messages  could  be  used  as  crypto¬ 
keys  for  subsequent  communication.  Finally,  we  remark 
that  the  states  and  measurements  described  here  are 
identical  to  those  used  in  the  BB84  protocol,  [6]  and  any 
apparatus  that  is  designed  to  implement  BB84  can  also 
implement  this  protocol  with  minor  modifications. 
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